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(57) Abstract: A method for detecting malicious code in a stream of data traffic input to a gateway in a data network by monitoring 
for suspicious data in the stream of data traffic. Upon detecting the suspicious data, an attempt is made to disassemble the suspicious 
data and a threat weight is assigned for each instruction. The attempt to disassemble is initiated at initial instructions each with a 
different offset within the suspicious portion of data. The threat weights are accumulated respectively for each branch opuon in 
the disassembled code, producing respectively an accumulated threat weight for each branch option. When the accumulated threat 
weight exceeds a previously defined threshold level, an alert is generated and/or traffic is blocked from the source of the malicious 
code. 
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